CVE-2026-4926highCWE-1333CWE-400

CVE-2026-4926: falha de alta gravidade em path-to-regexp

path-to-regexp vulnerable to Denial of Service via sequential optional groups

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar path-to-regexp+ Monitorar path-to-regexp

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.8%
Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
path-to-regexp · path-to-regexp
CVEs relacionadas — path-to-regexp

No mesmo produto, das mais perigosas para as menos.

CVE-2026-4867HIGHpath-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parametersEPSS 0.5%CVE-2026-4923MEDIUMpath-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcardsEPSS 0.4%